Release: multi-container Docker gateway API forwarding (#6917) (#6995)

* feat(docker): enable gateway API and password forwarding in compose files

- Added API_SERVER_KEY forwarding to enable the gateway API listener in multi-container setups.
- Configured HERMES_WEBUI_PASSWORD to ensure password authentication works as expected.
- Updated documentation to clarify API_SERVER_KEY requirements and forwarding behavior.
- Added regression tests to cover the new functionality and ensure proper configuration.

* build(docker): force LF line endings for shell scripts via .gitattributes

A CRLF shebang (#!/bin/bash\r) breaks locally-built Docker images: the
kernel can't resolve the interpreter /bin/bash\r, so 'docker compose up
-d --build' on Windows with core.autocrlf=true fails with
'exec /hermeswebui_init.bash: no such file or directory'. The repo blobs
and CI/GHCR builds are LF and unaffected; only Windows local builds
baked the CRLF checkout into the image.

* fixup(docker): dedup API_SERVER_HOST after rebase onto #6968 (which already added it)

* docs(changelog): stamp #6917 (multi-container gateway API forwarding)

---------

Co-authored-by: Yang <yang_qwq@qq.com>
Co-authored-by: nesquena-hermes <nesquena-hermes@users.noreply.github.com>

docs/docker.md

@@ -193,6 +193,22 @@ cp .env.docker.example .env
 docker compose -f docker-compose.two-container.yml up -d
 ```
 
+The compose files forward `API_SERVER_KEY` from `.env` into the `hermes-agent`
+container. The agent only starts the gateway API listener (port 8642) when
+`API_SERVER_KEY` is a usable value (>=16 chars) — `API_SERVER_ENABLED` alone
+does nothing. Without a key, the gateway daemon still runs but port 8642 stays
+unbound and the WebUI keeps showing **"Gateway endpoint not reachable"**. To
+enable scheduled ticking and the green gateway pill, set a long random string
+in `.env`:
+
+```bash
+echo "API_SERVER_KEY=$(openssl rand -hex 24)" >> .env
+docker compose -f docker-compose.two-container.yml up -d --force-recreate
+```
+
+The compose file forwards the same value to the WebUI as
+`HERMES_WEBUI_GATEWAY_API_KEY`, so the health probe authenticates automatically.
+
 The three-container layout adds the dashboard but is otherwise the same shape. If you must stay single-container, you can run `hermes gateway` inside the container as a long-lived background process, but the compose split is sturdier.
 
 If you maintain a custom compose file, make sure the **WebUI service** points at